Privacy Notice

What we collect

• Booking & account details — your name, email address, phone number and any details you give us about your shoot or session, so we can book you in, identify you, and manage your galleries and orders.
• Your photographs — the images we take of you and (where relevant) your family, guests or pets, which we deliver to you through our galleries.
• Gallery activity — which galleries and photos you view, the photos you favourite or download, and any galleries you share, so your selections are saved and we can deliver and improve your experience.
• App usage — the actions you take in the app (such as the pages you view and the features you use), linked to your account, together with basic technical details about your visit (device type, operating system, browser) and a one-way hashed version of your IP address. We hash the IP address so it can’t be read back as your real address; it’s used only to tell visits apart, keep you signed in, and guard against abuse.
• Phone calls — see “Phone calls” below.
• Messages — emails, texts and messages between you and us, so we have a record of our conversations and can help you.
• Gallery guests — if you’re invited to someone’s gallery or save access to one as a guest, your name and email address, so your favourites persist and we can send you a link to return.

Why we collect it

• To book, plan and deliver your photography and let you view, favourite and download your photos.
• To fulfil orders for prints, albums and other products.
• To communicate with you about your booking, galleries and orders.
• To run, secure and improve the app and our service.
• To meet our legal and tax obligations.
• To promote our work — with your agreement, we may feature images from your shoot in our portfolio, on our website and social media, and in our advertising. You can decline this, or ask us to stop, at any time, and it won’t affect your service.

When we collect your information from someone else

Sometimes we receive personal information about you from someone other than you — for example, when a couple shares their wedding gallery with you as a guest, or someone provides your details when booking a session that includes you. When that happens, this notice tells you what we collect and why, and your rights to access and correct it apply in the same way.

Is providing your information mandatory?

Most of what you give us is voluntary, but we can’t provide the service without the essentials — for example, we need your name and contact details to book you in and deliver your gallery. Some financial records we are required by law to keep for tax purposes.

Phone calls

We record some phone calls — most often the consultations you book with us — so we can take accurate notes and, occasionally, for quality and training. We make you aware that calls are recorded through this notice and our booking process. Recordings are kept only as long as we need them for those purposes (usually just long enough to write up our notes) and are then deleted. If you’d prefer a call not to be recorded, just let us know.

How we keep it secure

We take reasonable steps to protect your information — access controls, reputable hosting, and limiting who can see it to those who need to. No system is perfectly secure, but we work to keep your information safe and to put things right quickly if something goes wrong.

Who we share it with

We do not sell your personal information. We share it only with the service providers we rely on to run the business (who act on our behalf and are required to keep it secure), where you ask us to, or where the law requires it. The main providers are:

• Stripe — to process payments securely. Your card details are handled by Stripe and are not stored in our own systems. Stripe is based in the United States.
• Cloudflare — to store and deliver your photos and galleries. Cloudflare is a United States company and stores data across its global network, using the nearest available location where possible.
• SMTP2GO — to send you email such as sign-in links, gallery links and order updates. SMTP2GO is a New Zealand company; its sending servers are typically located in Australia.

Because some of these providers store or process information outside New Zealand, your information may be held overseas. These providers process it on our behalf and are required to protect it to standards comparable to the New Zealand Privacy Act 2020, and we remain responsible for how your information is handled.

How long we keep it

• Your photographs and galleries — we keep these indefinitely as our studio archive, so we can provide reprints and look after returning clients, unless you ask us to delete your images (see the copyright note below).
• Booking, account and activity information — for as long as you’re a client and for 7 years after your last interaction with us, after which we securely delete or de-identify it.
• Enquiries, gallery-guest details and analytics — where someone contacts us or views a gallery but doesn’t become a client, we keep that information for up to 24 months and then delete it.
• Financial and transaction records — at least 7 years, to meet our tax obligations, and sometimes longer where we have a genuine business reason.

Your photographs and copyright

Under our client agreement, copyright and usage rights in the photographs we create stay with Macalister Photography. How we keep and use your images is governed by that agreement rather than by a right to have them erased. You can always raise a concern about your images with us and we’ll consider it reasonably and in line with the law.

Cookies and app storage

Our app uses cookies and your browser’s local storage to keep you signed in, hold your session, and remember the state of your galleries — the app won’t work properly without these. We also record the actions you take in the app, linked to your account, to run, secure and improve the service. New Zealand law doesn’t require a cookie-consent pop-up, so we don’t show one, but we do tell you what we use cookies for here. You can block or delete cookies in your browser; blocking the essential ones may break parts of the app.

Marketing

Service messages — booking confirmations, invoices, and “your gallery is ready” notices — are part of the service you’ve asked for and aren’t marketing. We’ll only send you promotional emails if you’ve agreed or have an existing relationship with us that makes it reasonable, and every one will identify us and include a free way to unsubscribe. Opting out of marketing won’t stop the service messages you need.

Your rights: access and correction

You can ask for a copy of the personal information we hold about you, and ask us to correct it if it’s wrong. We’ll respond within 20 working days. If we decline a correction, you can ask us to attach a statement of the correction you sought. To make a request, email info@macalister.nz.

Deleting your account

Deleting your account revokes your access straight away. We then remove the personal information we don’t need to keep, retaining only what we’re legally required to (such as invoices and records of work we’ve done). This is handled by a person, not automatically.

If something goes wrong

If a privacy breach happens that we believe is likely to cause you serious harm, we’ll notify you and the Office of the Privacy Commissioner as soon as we’re practically able, as required by the Privacy Act 2020.

How to make a complaint

If you have a concern about how we’ve handled your information, please contact us first at info@macalister.nz so we can put it right. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner: privacy.org.nz · 0800 803 909 · Office of the Privacy Commissioner, PO Box 10 094, Wellington 6143.

Changes to this notice

We may update this notice from time to time. The version on this page is the current one.

Last updated: 22 July 2026.